feat: add sandboxed OpenCode Linux engine

[victurbo37-debug]

Summary

• add a built-in OpenCode worker engine with macOS Seatbelt and Linux bubblewrap sandbox selection
• confine Linux writes to the task directory and ephemeral runtime state while preserving required host reads
• preserve the Linux wrapper's LF shebang when the repository is checked out on Windows
• add focused engine and Linux sandbox contract tests, and install bubblewrap in Ubuntu CI

Context

This is split 1 of 5 from #31, following the maintainer's request for independently reviewable changes.

Validation

• python -m unittest tests.test_opencode_engine -v on Windows — 1 passed; 2 POSIX-only cases skipped
• python3 -m unittest tests.test_linux_sandbox_wrapper tests.test_opencode_engine -v on Ubuntu 26.04 WSL2 — 4 passed, no skips
• the same focused suite on a clean Ubuntu 24.04 WSL2 installation — 4 passed, no skips
• Ubuntu CI installs bubblewrap before running the full suite

[victurbo37-debug]

@justfinethanku — #67 is ready for review. The bubblewrap path now executes locally on both Ubuntu 24.04 and Ubuntu 26.04 WSL2: the focused Linux suite passes 4/4 with no skips. Its fork-originated GitHub Actions run is awaiting maintainer approval; please approve the workflow when convenient.